Migrating to AIX 5L (64 bits)

2004-11-15 Thread Samuel Gaudard
Hello, This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate,

Re: Migrating to AIX 5L (64 bits)

2004-11-15 Thread Samuel Gaudard
Sorry for this empty mail. Here is my question : I'm working for a project where we plan to migrate our OSfrom AIX 4.3 (32 bits) to AIX 5.2 (64 bits). We use some OpenSSL C libraries to implement DES encryption/decryption. I'm trying to figure out what would be the impact

smime certificates

2004-11-15 Thread openssl
I have been trying to renew a certificate geterated for signing emails. The renew goes ok. first revoke old one then resign req with new end date etc. and I can use the new certificate ok. However if I try and open an old email sent from home using my old certificate to sign it - I can't Outlook

Re: smime certificates

2004-11-15 Thread Bernhard Froehlich
[EMAIL PROTECTED] wrote: I have been trying to renew a certificate geterated for signing emails. The renew goes ok. first revoke old one then resign req with new end date etc. and I can use the new certificate ok. However if I try and open an old email sent from home using my old certificate to

EVP_DecryptUpdate returns zero length

2004-11-15 Thread Brad Hards
In a larger application (Qt Cryptographic Architecture), I'm trying to wrap some OpenSSL crypto primitives in C++. However I'm having a problem with EVP_DecryptUpdate(). I've done up a quick'n'dirty test case, see below. Now for EVP_EncryptUpdate, this gives me 16. But for EVP_DecryptUpdate(), it

Re: smime certificates

2004-11-15 Thread openssl
[EMAIL PROTECTED] wrote: I have been trying to renew a certificate geterated for signing emails. The renew goes ok. first revoke old one then resign req with new end date etc. and I can use the new certificate ok. However if I try and open an old email sent from home using my old certificate to

Re: EVP_DecryptUpdate returns zero length

2004-11-15 Thread Dr. Stephen Henson
On Mon, Nov 15, 2004, Brad Hards wrote: In a larger application (Qt Cryptographic Architecture), I'm trying to wrap some OpenSSL crypto primitives in C++. However I'm having a problem with EVP_DecryptUpdate(). I've done up a quick'n'dirty test case, see below. Now for EVP_EncryptUpdate, this

How to create CA cert, server and client cert from one config file

2004-11-15 Thread Patrick Ben Koetter
I am on my way to learn more about OpenSSL. My current task is to create a script, similar to CA.pl, to ease cert handling. Ideally I would want to have one config file, holding different values for a CA cert, a server cert and a client cert separated by sections. This would require to have (at

Re: How to create CA cert, server and client cert from one config file

2004-11-15 Thread Dr. Stephen Henson
On Mon, Nov 15, 2004, Patrick Ben Koetter wrote: I am on my way to learn more about OpenSSL. My current task is to create a script, similar to CA.pl, to ease cert handling. Ideally I would want to have one config file, holding different values for a CA cert, a server cert and a client cert

Re: smime certificates

2004-11-15 Thread Dr. Stephen Henson
On Mon, Nov 15, 2004, [EMAIL PROTECTED] wrote: The link that outlook appears to use is the serial number, if it does not find a certificate with the same serial number as the one in the message it will not find the private key to decrypt the message. This is part of the S/MIME v2 (PKCS#7)

Re: How to create CA cert, server and client cert from one config file

2004-11-15 Thread Patrick Ben Koetter
* Dr. Stephen Henson [EMAIL PROTECTED] [041116 00:45]: On Mon, Nov 15, 2004, Patrick Ben Koetter wrote: I am on my way to learn more about OpenSSL. My current task is to create a script, similar to CA.pl, to ease cert handling. Ideally I would want to have one config file, holding

Re: smime certificates

2004-11-15 Thread Jason Haar
Dr. Stephen Henson wrote: Well unless the software provides a means to reencrypt with a new certificate the only way is to keep the old certificates and private keys on the system. soapbox This is something I noticed before too - and appears to be a real failing with PKI. Although by failing I

Re: How to create CA cert, server and client cert from one config file

2004-11-15 Thread Dr. Stephen Henson
On Tue, Nov 16, 2004, Patrick Ben Koetter wrote: To clarify my second question: Can I put config options for a CA, server and or client certificate in a single config file and have certs built automatically? I haven't understood yet how sections work exactly. I understand they subsume

Doubt regarding cert-chain validation (fwd)

2004-11-15 Thread Suram Chandra Sekhar
Hi all, I hava a doubt regarding X509_verify_cert. What I understand from the documentation of verify is that we need to pass all the trusted certs and all the un-trusted certs. X509_verify_cert will construct the cert chain upto the ROOT CA and then validates the chain and finally verify the

Re: smime certificates

2004-11-15 Thread Bernhard Froehlich
Jason Haar wrote: soapbox This is something I noticed before too - and appears to be a real failing with PKI. Although by failing I mean not what end-users expect... Let's assume the whole world has embraced PKI and everyone is sending/receiving S/MIME encrypted e-mails. How are we (as a